You have a Microsoft 365 subscription that contains 1,000 users and a group named Group1. All the users have Windows 11 devices. The users sign in to their devices by using their Microsoft Entra account. The users do NOT have administrative rights to their devices.The members of Group1 remotely assist the users by taking control of user sessions. The remote control sessions run in the security context of the users they are assisting.You need to recommend a solution that will enable the Group1 members to run apps that require administrative rights to the users' devices. The solution must ensure that the apps are run in the context of each signed-in standard user.What should you include in the recommendation?
Answer(s): C
With Microsoft Intune Endpoint Privilege Management (EPM) your organization's users can run as a standard user (without administrator rights) and complete tasks that require elevated privileges. Tasks that commonly require administrative privileges are application installs (like Microsoft 365 Applications), updating device drivers, and running certain Windows diagnostics.Endpoint Privilege Management supports your Zero Trust journey by helping your organization achieve a broad user base running with least privilege, while allowing users to still run tasks allowed by your organization to remain productive. For more information, see Zero Trust with Microsoft Intune.Incorrect:Not A:Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.Not B:Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility into permissions assigned to all identities (users and workloads), actions, and resources across cloud infrastructures. It detects, right-sizes, and monitors unused and excessive permissions and enables Zero Trust security through least privilege access in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).Not D:Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about.
https://learn.microsoft.com/en-us/mem/intune/protect/epm-overview
HOTSPOTYou have a Microsoft 365 subscription that contains 1,000 users and two groups named Group1 and Group2. All the users have devices that are onboarded to Microsoft Intune and Microsoft Defender for Endpoint. Group1 manages Microsoft Entra and Microsoft 365 services. Group2 manages Intune and Defender for Endpoint.You need to recommend a solution to prevent users from connecting to Microsoft 365 services from devices that have encryption disabled.What should you recommend implementing for each group? To answer, select the options in the answer area.Note: Each correct answer is worth one point.Hot Area:
Answer(s): A
Box 1: A Conditional Access policyGroup1 manages Microsoft Entra and Microsoft 365 services.Microsoft Entra ID, Conditional Access, Common Conditional Access policy: Require a compliant device, Microsoft Entra hybrid joined device, or multifactor authentication for all users Organizations who deploy Microsoft Intune can use the information returned from their devices to identify devices that meet compliance requirements such as:Requiring a PIN to unlock*-> Requiring device encryptionRequiring a minimum or maximum operating system versionRequiring a device isn't jailbroken or rootedBox 2: A compliance policy in IntuneGroup2 manages Intune and Defender for Endpoint.Device Compliance settings for Windows in Intune includes:* EncryptionEncryption of data storage on a device:This setting applies to all drives on a device.Not configured (default)Require - Use Require to encrypt data storage on your devices. DeviceStatus CSP - DeviceStatus/Compliance/EncryptionCompliance
https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-compliant- device https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows
You have a Microsoft 365 subscription and an Azure subscription. Microsoft Defender XDR and MicrosoftDefender for Cloud are enabled.The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.Which security control should you recommend?
Answer(s): D
Microsoft Defender for Endpoint includes application control policies that allow you to define which applications are authorized to run on a machine. This can help block any unauthorized applications and provide an approval mechanism, ensuring that only approved software is allowed to run.The solution aligns with the requirement to block unauthorized applications from running on the virtual machines automatically until approved by an administrator.
You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.The subscription uses sensitivity labels to classify corporate documents. All the users have Windows 11 devices that are onboarded to Microsoft Defender for Endpoint and are configured to sync files to Microsoft OneDrive.You need to prevent the users from uploading the documents from OneDrive to external websites.What should you include in the solution?
Answer(s): B
Microsoft Purview Data Loss Prevention (DLP) policies help protect sensitive information by preventing data leakage and restricting data sharing, even across cloud platforms. By using DLP, you can define rules that prevent users from uploading classified documents, such as those with sensitivity labels, from OneDrive to unauthorized external websites. DLP policies can control actions like copy, download, and upload based on content classification, location, and user context.
You have a Microsoft Entra tenant. The tenant contains 500 Windows devices that have the Global Secure Access client deployed.You have a third-party software as a service (SaaS) app named App1.You plan to implement Global Secure Access to manage access to App1.You need to recommend a solution to manage connections to App1. The solution must ensure that users authenticate by using their Microsoft Entra credentials before they can connect to App1.What should you include the recommendation?
A Global Secure Access app is the best solution to manage access to a third-party SaaS application, such as App1. By configuring this app within Microsoft Entra, you can enforce authentication policies that require users to log in with their Microsoft Entra credentials before accessing the SaaS application. This setup provides centralized access management, secure access controls, and ensures consistent user authentication for App1.
You have a Microsoft 365 tenant that contains two groups named Group1 and Group2.You use Microsoft Defender XDR to manage the tenants of your company's customers.You need to ensure that the users in Group1 can perform security tasks in the tenant of each customer. The solution must meet the following requirements:The Group1 users must only be assigned the Security Operator role for the customer tenants.The users in Group2 must be able to assign the Security Operators role to the Group1 users for the customer tenants.The use of quest accounts must be minimized.Administrative effort must be minimized.What should you include in the solution?
Azure Lighthouse includes multiple ways to help streamline engagement and management:* Azure delegated resource management: Manage your customers' Azure resources securely from within your own tenant, without having to switch context and control planes. Customer subscriptions and resource groups can be delegated to specified users and roles in the managing tenant, with the ability to remove access as needed.* Etc.Incorrect:Not A: Multi-Factor Authentication for Email and Office 365. Multi-Factor authentication (a.k.a. MFA) is a method to help better secure email accounts and Office 365 access. This additional security comes from having to Approve the sign-ins to your account using a mobile device.
https://learn.microsoft.com/en-us/azure/lighthouse/overview
You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes.Incoming email from the internet is scanned for security threats by using a third-party cloud service.You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365.What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?
Configure mail flow using connectors in Exchange OnlineConnectors are a collection of instructions that customize the way your email flows to and from your Microsoft 365 or Office 365 organization.What do connectors do?Connectors are used in the following scenarios:Enable mail flow between Microsoft 365 or Office 365 and email servers that you have in your on-premises environment (also known as on-premises email servers).*-> Apply security restrictions or controls to email that's sent between your Microsoft 365 or Office 365 organization and a business partner or service provider.Relay mail from devices, applications, or other non-mailbox entities in your on-premises environment through Microsoft 365 or Office 365.Avoid graylisting that would otherwise occur due to the large volume of mail that's regularly sent between your Microsoft 365 or Office 365 organization and your on-premises environment or partners.
https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/ use-connectors-to-configure-mail-flow
HOTSPOTYour network contains an Active Directory Domain Services (AD DS) domain named Domain1.You have a Microsoft Entra tenant.Domain1 syncs with the tenant by using Microsoft Entra Connect Sync.You need to evaluate Microsoft Entra smart lockout by testing the following account lockout considerations:The number of failed sign-in attempts that trigger a lockoutThe duration of the lockoutWhat should you use to test each consideration? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: AD DS and Microsoft Entra IDThe number of failed sign-in attempts that trigger a lockout.Smart lockout can be integrated with hybrid deployments that use password hash sync or pass-through authentication to protect on-premises Active Directory Domain Services (AD DS) accounts from being locked out by attackers. By setting smart lockout policies in Microsoft Entra ID appropriately, attacks can be filtered out before they reach on-premises AD DS.When using pass-through authentication, the following considerations apply:* The Microsoft Entra lockout threshold must be less than the AD DS account lockout threshold. Set the values so that the AD DS account lockout threshold is at least two or three times greater than the Microsoft Entra lockout threshold.* The Microsoft Entra lockout duration must be longer than the AD DS account lockout duration. The Microsoft Entra duration is set in seconds, while the AD DS duration is set in minutes.TipThis configuration ensures Microsoft Entra smart lockout stops your on-premises AD DS accounts from being locked out by brute force attacks, like password spray attacks on your Microsoft Entra accounts.Box 2: AD DS and Microsoft Entra IDThe duration of the lockout.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.